PT-2019-7593

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 58.0.4 Description The issue allows visitors to the WHM "Purchase and Install an SSL Certificate" page to list all server domains. Recommendations For versions prior to 58.0.4, update to version 58.0.4 or later to...

CVE-2016-10797: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...

CVE-2017-18466

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

CVE-2017-18466

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

CVE-2017-18466

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

PT-2019-8401

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 62.0.17 Description The issue arises from improper recognition of domain ownership when adding parked domains to a mail configuration. Recommendations For versions prior to 62.0.17, update to version 62.0.17 or later t...

CVE-2017-18466: Improper Input Validation

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration SEC-228...

PT-2019-8390

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 62.0.17 Description The issue concerns the conversion of addon domains, which did not require a package for resellers. Recommendations For versions prior to 62.0.17, update to version 62.0.17 or later to resolve the...

CVE-2016-10813

cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...

CVE-2016-10813

cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...

Design/Logic Flaw

cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...

CVE-2016-10813

CVE-2016-10813 affects cPanel prior to 57.9999.54, where an input handling flaw during FTP account creation under addon domains allows self-XSS. Root cause: insufficient input validation in the addon domains FTP creation flow. Impact: client-side script execution under the victim’s browser; no se...

Design/Logic Flaw

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

PT-2019-7609

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 57.9999.54 Description The issue allows self XSS during ftp account creation under addon domains. Recommendations For versions prior to 57.9999.54, update to version 57.9999.54 or later to resolve the issue...

CVE-2016-10813: Improper Neutralization of Input During Web Page Generation

cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...

Design/Logic Flaw

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains SEC-478...

CVE-2019-14414

CVE-2019-14414 affects cPanel before 78.0.2, where a Userdata cache temporary file can conflict with domains (SEC-478). The vulnerability concerns the Userdata cache handling and is documented with a Low severity (CVSSv2/3: low, local access, partial integrity impact). Exploitation details are no...

PT-2019-13681

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 78.0.2 Description The issue allows format-string injection in the DCV check domains via dns UAPI. Recommendations For versions prior to 78.0.2, update to version 78.0.2 or later to resolve the issue...

PT-2019-13683

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 78.0.2 Description A conflict can occur between a Userdata cache temporary file and domains in cPanel. Recommendations For versions prior to 78.0.2, update to version 78.0.2 or later to resolve the issue...

'Google' Sites Are the Latest Ploy by Card-Skimming Thieves

Malicious domains masquerading as Google sites are the latest ploy by payment card-skimming adversaries looking to dupe website visitors. According to analysts at Sucuri, cybercriminals are using typosquatting the practice of changing one letter in a trusted site name to use as a malicious URL to...